Disney+ fans without answers after thousands hacked
1–10 of 88 posts
Re: Disney+ fans without answers after thousands hacked
#2I don't know what answer they're due, except "This happened because you reused a password".
Re: Disney+ fans without answers after thousands hacked
#3yikes. It doesn't support the security feature of logging everyone out of the account? So if a someone gets access to your account they're in for good.
Re: Disney+ fans without answers after thousands hacked
#4I am sure Netflix and amazon prime users also reuse their passwords, but I haven’t yet heard about users having the Disney+ issues with these accounts.
Re: Disney+ fans without answers after thousands hacked
#5It would really make me laugh if Disney was at fault but it sounds like people with compromised credentials reusing those same creds.
Re: Disney+ fans without answers after thousands hacked
#6yikes. It doesn't support the security feature of logging everyone out of the account? So if a someone gets access to your account they're in for good.
Sounds like JSON web tokens! Should have stuck to sessions if that's the case.
Admittedly, the performance benefits of jwt are probably warranted here. But still, you either end up building an in-memory blacklist or a DB table thus negating most benefits.
Re: Disney+ fans without answers after thousands hacked
#7I am sure Netflix and amazon prime users also reuse their passwords, but I haven’t yet heard about users having the Disney+ issues with these accounts.
Netflix and amazon might check against leaked passwords, and / or require sms or email verification when an unusual login attempt is detected.
Re: Disney+ fans without answers after thousands hacked
#8Re: Disney+ fans without answers after thousands hacked
#9I am sure Netflix and amazon prime users also reuse their passwords, but I haven’t yet heard about users having the Disney+ issues with these accounts.
No idea about Netflix, but for Amazon I bet there’s less account sharing than the other two - because it’s your actual Amazon account. My Netflix account is the only one that doesn’t have a very complex password manager password, because I share it with family. I won’t share my amazon account because I won’t give it that sort of password. I guess Disney+ is much closer to Netflix on that scale.
Re: Disney+ fans without answers after thousands hacked
#10yikes. It doesn't support the security feature of logging everyone out of the account? So if a someone gets access to your account they're in for good.
Sounds like JSON web tokens! Should have stuck to sessions if that's the case. Admittedly, the performance benefits of jwt are probably warranted here. But still, you either end up building an in-memory blacklist or a DB table thus negating most benefits.
It's not that hard to build a highly available active-active session service given time and engineering headcount.
It's hard if you're trying to get out the door fast, though.